Service based bearer control and traffic flow template operation with mobile IP

ABSTRACT

A method for updating filters, at a Packet Data Serving Node, with a care-of-address associated with at least one of a mobile station or a correspondent node. The method includes the steps of implementing a soft filtering rule at a Packet Data Serving Node and receiving, by the Packet Data Serving Node, a care-of-address that is associated with at least one the mobile station and a correspondent node. The method also includes updating, by the Packet Data Serving Node, filters with the care-of-address to correctly identify flows belonging to a particular session during Mobile IP use. The method further includes filtering, by the Packet Data Serving Node, packets including a care-of-address that is associated with one of the mobile station and the correspondent node.

This is a Continuation of application Ser. No. 11/142,360, filed Jun. 2,2005, which claims the priority of U.S. Provisional Application No.60/576,406, filed on Jun. 3, 2004 and provisional application No.60/588,347, filed on Jul. 16, 2004. The disclosures of the priorapplications are hereby incorporated by reference in their entirety.

BACKGROUND OF THE INVENTION

1. Field of the Invention

The present invention relates to method for solving Mobile IP relatedfiltering issues and more particularly to a method for creating filtersthat allow for the use of care-of-address by a mobile station and acorrespondent node.

2. Description of the Related Art

In cdma2000 networks, a Packet Data Serving Node (PDSN) acts as anaccess node for a mobile station and creates a number of filters foractive sessions associated with the mobile station. Specifically, thereare two types of filters in the PDSN. The first type includes ServiceBased Local Policy (SBLP) filters that are set up by the network forMultimedia Messaging Service (MMS). These filters are based on thesubscriber profile of the mobile station and are set up by a PolicyDecision Function (PDF) associated with the PDSN. The second typeincludes Traffic Flow Template (TFT) that is set up by the mobilestation for traffic flows. These filters provide specific flow treatmentto each session between the mobile station and the PDSN. As such, thePDSN does not allow any un-authorized traffic that does not match any ofthe filters to be forwarded to or from the mobile station. Typically,the filters have source and destination addresses/ports as selectors inorder to be able to identify the flows.

When using Mobile IP, the mobile station uses its home address duringSession Initiation Protocol (SIP) negotiation for a session between themobile station and a correspondent node. Thus, the SBLP filters set upby Proxy Call Session Control Function (P-CSCF) and PDF include the homeaddresses of the mobile station and the correspondent node. However, themobile station is assigned a care-of-address from a visited network inaddition to its home address when the mobile station is using Mobile IP.Thereafter, all traffic sent by the mobile station has thecare-of-address as the source address. Similarly, traffic from thecorrespondent node includes the mobile station's care-of-address as thedestination address. As such, the information in the packets from themobile station does not match any of the filters set up at the PDSN andthe packets are dropped by the PDSN.

The problem described above becomes worse when the correspondent node isalso a mobile node and uses its care-of-address as the source address.In addition to packets from the mobile station being dropped by thePDSN, when the correspondent node uses its care-of-address as the sourceaddress, packets from the correspondent node also do not match any ofthe filters at the PDSN that have the correspondent node's home address.Moreover, even in solutions where the PDSN somehow updates the filterswith the correspondent node's care-of-address, if the correspondent nodemoves and attaches to a new IP subnet, then its care-of-address changesin the middle of a session causing packets with the new care-of-addressto not match the source address in the filters of the PDSN and the PDSNto drop the packets.

In one example that further describes the problem outlined above, duringthe session between the correspondent node and the mobile station, thecorrespondent node performs return routablility and route optimizationfunctions and sends a Care-of-Test init message to the mobile station.The message includes the correspondent node's care-of-address in thesource field. As such, the source address for the correspondent node inthe message does not match the information in the SBLP filters that wasestablished during SIP negotiation, causing the PDSN to drop the packet.Hence, the mobile station will not receive the message and the returnroutablility and route optimization functions will fail.

One solution to the problem identified above is to map the packet to adefault service instance at the PDSN. This causes the packet to reachthe mobile station so that the return routablility and routeoptimization functions can proceed as normal. If the route optimizationfunction succeeds, all subsequent packets from the correspondent node tothe mobile station will have the correspondent node's care-of-address inthe source field. This solution, however, causes a permanent failure ofthe SBLP filter and makes the mobile station vulnerable toDenial-of-Service attacks because any sender with a malicious intent canflood the mobile station with junk IP packets using any source address.Furthermore, destination packets will also have the correspondent node'scare-of-address instead of its home address. However, if packets fromthe mobile station to the correspondent node do not include thecorrespondent node's home address, the PDSN will not allow the packetsto be forwarded to the correspondent node.

The problem is slightly different with TFT filters. When the mobilestation sets up TFT filters, it uses the correspondent node's homeaddress. When the correspondent node sends packets using itscare-of-address as the source address, these packets will not match theTFT filters at the PDSN and hence will not get the right flow treatment.

SUMMARY OF THE INVENTION

According to one aspect of the invention, there is provided a method forupdating filters, at a Packet Data Serving Node, with a care-of-addressassociated with at least one of a mobile station or a correspondentnode. The method includes the steps of implementing a soft filteringrule at a Packet Data Serving Node and receiving, by the Packet DataServing Node, a care-of-address that is associated with at least one themobile station and a correspondent node. The method also includesupdating, by the Packet Data Serving Node, filters with thecare-of-address to correctly identify flows belonging to a particularsession during Mobile IP use. The method further includes filtering, bythe Packet Data Serving Node, packets including a care-of-address thatis associated with one of the mobile station and the correspondent node.

According to another aspect of the invention there is provided a networknode for updating filters with a care-of-address associated with atleast one of a mobile station or a correspondent node. The network nodeincludes implementing means for implementing a soft filtering rule andreceiving means for receiving a care-of-address that is associated withat least one a mobile station and a correspondent node. The network nodealso includes updating means for updating filters with thecare-of-address to correctly identify flows belonging to a particularsession during Mobile IP use. The network node further includesfiltering means for filtering packets including a care-of-address thatis associated with one of the mobile station and the correspondent node.

According to another aspect of the invention, there is provided anapparatus for updating filters, at a Packet Data Serving Node, with acare-of-address associated with at least one of a mobile station or acorrespondent node. The apparatus includes implementing means forimplementing a soft filtering rule at a Packet Data Serving Node. Theapparatus also includes receiving means for receiving, by the PacketData Serving Node, a care-of-addresses associated with at least one ofthe mobile station and a correspondent node. The apparatus furtherincludes updating means for updating, by the Packet Data Serving Node,filters with the care-of-address to correctly identify flows belongingto a particular session during Mobile IP use. The method also includesfiltering means for filtering, by the Packet Data Serving Node, packetsincluding the care-of-address that is associated with one of the mobilestation and the correspondent node.

BRIEF DESCRIPTION OF THE DRAWINGS

The accompanying drawings, which are included to provide a furtherunderstanding of the invention and are incorporated in and constitute apart of this specification, illustrate embodiments of the invention thattogether with the description serve to explain the principles of theinvention, wherein:

FIG. 1 illustrates a wireless network 100 that can be used in anembodiment of the invention; and

FIG. 2 illustrates the steps implemented in an embodiment of the presentinvention.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENT(S)

Reference will now be made to the preferred embodiments of the presentinvention, examples of which are illustrated in the accompanyingdrawings.

FIG. 1 illustrates a wireless network 100 that can be used in anembodiment of the invention. Network 100 includes a mobile station 102,a correspondent node 104, a Packet Data Serving Node (PDSN) 106 and aPolicy Decision Function 108. Mobile station 102 is a part of a wirelessnetwork that is running Internet Protocol version 6 (IPv6) and mobilestation 102 configures its IPv6 address with a prefix from PDSN 106.During SIP negotiation for a session between mobile station 102 andcorrespondent node 104, correspondent node 104 uses its home address asthe connection address and the mobile station uses its IPv6 address asthe connection address. Policy Decision Function 108 then sends aService Based Local Policy (SBLP) filter set to PDSN 106 for PDSN 106 toapply the SBLP filter on bearer flows associated with the negotiatedsession. As such the SBLP filter set includes correspondent node's homeaddress as its source and destination address. Additionally, mobilestation 102 send a Traffic Flow Template (TFT) to PDSN 106 to map theresulting flow(s) to desired service instances. The TFT also includesthe correspondent node's home address as its source address.

To resolve issues relating to matching filters in PDSN 106 withcare-of-addresses associated with mobile station 102 and correspondentnode 104 during Mobile IP, one embodiment of the invention requires PDSN106 to be aware of the home addresses and care-of-address of mobilestation 102 and correspondent node 104 at all times to be able to matchthe IP flows with the filters. Specifically, PDSN 106 is required toknow the mobile station's home address, the mobile station's care ofaddress, the correspondent node's home address and the correspondentnode's care of address, if the correspondent node is also a mobile node,at all times. This embodiment therefore requires that the PDSN's filtersbe updated once mobile station 102 knows its care-of-address and itshome address. The filters also need to be updated every timecorrespondent node 104 moves and acquires a new care of address.

An embodiment of the invention provides a generic solution to solveMobile IP related SBLP and TFT operation issues. A soft filtering rulehas been installed in PDSN 106 to allow Mobility Header messages.Specifically, the soft rule installed in the PDSN allows one messageevery 400 seconds per Mobility Header message type. If Mobility Headermessages are sent more often, they are dropped by the PDSN. The 400seconds is based on the fact that the maximum binding lifetime forreturn routability mechanisms is 420 seconds. However, the embodiment ofthe invention allows for a configurable parameter in place of the 400seconds on PDSN 106. Therefore, as is apparent to one of ordinary skillin the art an operator may use different values.

According to another embodiment of the invention, if mobile station 102and correspondent node 104 already have an active route optimisedsession, the soft rule can be modified to allow one message every oneminute per Mobility Header message type per mobile station 102care-of-address. This is based on the assumption that mobile nodes donot move more often than one minute. This soft rule allows RouteOptimization and Mobile IP signalling messages to be initiated by mobilenodes from outside the CDMA network. The invention limits mobilityheader messages to avoid dropping by PDSN 106.

In addition to the soft rule outlined above, once mobile station 102knows the set of possible addresses that might appear on its IPsessions, mobile station 102 sends a care-of-address update message toPDSN 106 for PDSN 106 to update the filters specific to mobile station102. Mobile station 102 also informs PDSN 106 whenever thecare-of-address of correspondent node 104 changes. Specifically, ifcorrespondent node 104 is also a mobile node and acquires a new care ofaddress, correspondent node 104 updates mobile station 102 with its newcare-of-address as part of Mobile IP operation. The soft rule describedin an embodiment of the invention allows return routability messagesfrom the new care-of-address of correspondent node 104 to reach mobilestation 102. Mobile station 102 then sends a message to PDSN 106 toupdate the filters. The invention therefore allows for the use of acare-of-address update message to update filters which are specific tomobile station 102. PDSN 106 uses the care-of-address information, inaddition to available SBLP parameters, to match packets against thefilters. This allows PDSN 106 to correctly identify the flows belongingto a particular session when Mobile IP is used. Specifically, PDSN 106uses the care-of-address information for matching the filters againstincoming and outgoing packets when Mobile IP is used.

In cdma2000 networks, mobile station 102 and PDSN 106 always establish aPPP link. According to embodiments of the invention, the care-of-addressupdate message can utilize vendor specific extensions, RSVP messages, orother update message types which are appropriate for a particularapplication. In one embodiment, mobile station 102 uses a PPP VendorSpecific Packet to update the filters at PDSN 106. According to anotherembodiment of the invention, mobile station 102 uses Resv and ResvConfmessages for TFT filter establishment at PDSN 106. These messages may bereused to send the Filter Update message that is defined in the TFT.Specifically, mobile station 102 may use the Resv message to send thefilter update to PDSN 106. When PDSN 106 receives a care-of-addressupdate message from mobile station 102, it updates the care-of-addressinformation, if any, attached to both SBLP and TFT filters specific tomobile station 102. According to an embodiment, PDSN 106 never replacesthe IP address found in the filters with the care-of-address address.

The discussion above is based on the assumption that PDSN 106 acceptsthe filter update messages from mobile station 102. In some cases,however, PDSN 106 might refuse to update filters created by PDF 108without explicit authorization from PDF 108 prior to updating thefilters. In these cases, mobile station 102 sends a filter update RSVPmessage along with a token that identifies mobile station 102 to PDF108. PDSN 106 sends an authorization request that includes the tokensent by mobile station 102 in the RSVP message. PDF 108 determines thatthe authorization request from mobile station 102 is for filtersassociated with the care-of-address of correspondent node 104.Thereafter, PDF 108 sends an authorization response to PDSN 106, whichenables PDSN 106 to update the filters with the care-of-address ofcorrespondent node 104.

The invention may also include a configuration wherein aftercorrespondent node 104 starts using a new care-of-address, PDSN 106checks the data packets to observe a change of care-of-address. In anembodiment, PDSN 106 may observe a predefined number of packets with thenew care-of-address/home address association before it updates thecare-of-address information attached to the filters.

The invention may also include a configuration wherein PDSN 106 createsa temporary state upon detecting a binding update message fromcorrespondent node 104. In such a configuration, mobile station 102 maythen send a binding acknowledgement to assure the network that a validbinding update was received. PDSN can then update the care-of-addressinformation attached to the packet filters. Specifically, PDSN 106creates a temporary state upon detecting a Binding Update message fromcorrespondent node 104. Thereafter, when mobile station 102 sends aBinding Acknowledgement message with an indication of success, thenetwork is assured that the Binding Update message was a valid, and PDSN106 can update the care-of-address information attached to the packetfilters.

The invention can also include a configuration wherein filter matchingis performed at the PDSN 106. The SBLP and TFT are initially set tomatch the home addresses of mobile station 102 and correspondent node104. When correspondent node 104 (or the mobile station 102) startsusing a care of address, packets from mobile station 102 andcorrespondent node 104 will not match the filters set at the PDSN. Ifthe correspondent node moves, it initiates return routability signalingto update mobile station 102. After return the routability signaling iscomplete, correspondent node 104 starts using the new care of address.Correspondent node 104 uses the care-of-address to communicate withmobile station 102, whenever Mobile IP is used, and PDSN 106 performsthe appropriate filter matching. Specifically, in the downlinkdirection, the source IP address part of a filter is considered a matchwith a packet in the downlink direction when the IP address matches thesource field of the IP packet; or the IP address matches the homeaddress field of the Destination Options extension header and thecare-of-address of correspondent node 104 matches the source field ofthe packet. In the uplink direction, the destination IP address part ofa filter is considered a match with a packet in the uplink directionwhen the IP address matches the destination field of the IP packet orthe IP address matches the home address field of the routing extensionheader and the care-of-address of the correspondent node matches thedestination field of the packet. Note that the care-of-address ofcorrespondent node 104 is available at the PDSN and updated by mobilestation 102 as described above. As is apparent to one skilled in theart, other matching configurations may be within the scope and spirit ofthe invention.

FIG. 2 illustrates the steps implemented in an embodiment of the presentinvention. In Step 2010, PDSN 106 implements the soft filteringmechanism of the present invention. In Step 2020, when mobile station102 knows its home address and care-of-address and correspondent node'shome address and care-of-address, mobile station 102 implements thefilter update message. In Step 2030, mobile station 102 may have toimplement the token authorization mechanism if PDSN 106 does not acceptun-authorized updates to SPLP filters. In Step 2040, when PDSN 106receives the filter update message from mobile station 102, PDSN 106updates the filters that correspond to mobile station 102 if PDSN 106does not require authorization from the PDF 108. In Step 2050, ifupdating the filters requires PDF 108 authorization, PDSN 106 sends aRADIUS message to PDF 108 to verify that mobile station 102 is allowedto update the filters. In Step 2060, PDF 108 verifies the tokenpresented by mobile station 102 and sends an authorization message toPDSN 106 in order for PDSN 106 to update the filters that correspond tomobile station 102.

One having ordinary skill in the art will readily understand that theinvention as discussed above may be practiced with steps in a differentorder, and/or with hardware elements in configurations which aredifferent than those which are disclosed. Therefore, although theinvention has been described based upon these preferred embodiments, itwould be apparent to those of skill in the art that certainmodifications, variations, and alternative constructions would beapparent, while remaining within the spirit and scope of the invention.In order to determine the metes and bounds of the invention, therefore,reference should be made to the appended claims.

1. A method, comprising: implementing a soft filtering rule at a packetdata serving node; receiving, at the packet data serving node, acare-of-address associated with at least one of the mobile station and acorrespondent node different from the packet data serving node; andupdating, at the packet data serving node, at least one of a pluralityof filters configured in accordance with the soft filtering rule, the atleast one of the plurality of filters updated with the care-of-addressto correctly identify flows belonging to a particular session duringmobile internet protocol use.
 2. The method of claim 1, wherein theimplementing comprises allowing at least one mobility header message ata predetermined time, wherein the predetermined time is a configurableparameter.
 3. The method of claim 2, wherein the predetermined time is400 seconds.
 4. The method of claim 1, wherein the updating comprisesupdating a service based local policy and a traffic flow template. 5.The method of claim 1, wherein the filtering comprises matching a sourceinternet protocol address part of a filter with a packet in a downlinkdirection when at least one of the source internet protocol addressmatches a source field of an internet protocol packet or the sourceinternet protocol address matches a home address of a destinationoptions extension header and the care-of-address of the correspondentnode matches the source field of the packet.
 6. The method of claim 1,wherein the filtering comprises matching a destination internet protocoladdress part of a filter with a packet in a uplink direction when atleast one of a internet protocol address matches a destination field ofan internet protocol packet or the internet protocol address matches ahome address of a routing extension header and the care-of-address ofthe correspondent node matches the destination field of the packet.
 7. Amethod, comprising: implementing a soft filtering rule at a packet dataserving node; receiving, at the packet data serving node, acare-of-address associated with at least one of the mobile station and acorrespondent node; and updating, at the packet data serving node, atleast one of a plurality of filters configured in accordance with thesoft filtering rule, the at least one of the plurality of filtersupdated with the care-of-address to correctly identify flows belongingto a particular session during mobile internet protocol use, wherein theimplementing comprises allowing one message at a predetermined time permobility header message type for the care-of-address, if the mobilestation and the correspondent node have an active route optimizedsession.
 8. A method, comprising: implementing a soft filtering rule ata packet data serving node; receiving, at the packet data serving node,a care-of-address associated with at least one of the mobile station anda correspondent node; and updating, at the packet data serving node, atleast one of a plurality of filters configured in accordance with thesoft filtering rule, the at least one of the plurality of filtersupdated with the care-of-address to correctly identify flows belongingto a particular session during mobile internet protocol use, wherein theimplementing comprises initiating route optimization and mobile internetprotocol signaling messages by mobile stations outside of a codedivision multiple access network.
 9. A method, comprising: implementinga soft filtering rule at a packet data serving node; receiving, at thepacket data serving node, a care-of-address associated with at least oneof the mobile station and a correspondent node; and updating, at thepacket data serving node, at least one of a plurality of filtersconfigured in accordance with the soft filtering rule, the at least oneof the plurality of filters updated with the care-of-address tocorrectly identify flows belonging to a particular session during mobileinternet protocol use, wherein the receiving comprises receiving, fromthe mobile station, a care-of-address update message when the mobilestation determines a set of possible addresses that might appear on aninternet protocol session that is associated with the mobile station.10. The method of claim 9, wherein the receiving comprises receiving thecare-of-address update message in one of vendor specific extensions,resource reservation protocol messages, or other message types from themobile station.
 11. The method of claim 10, wherein the receivingcomprises informing the mobile station of a newly acquiredcare-of-address by the correspondent node.
 12. A method, comprising:implementing a soft filtering rule at a packet data serving node;receiving a care-of-address associated with at least one of the mobilestation and a correspondent node; and updating filters with thecare-of-address to correctly identify flows belonging to a particularsession during mobile internet protocol use, wherein the receivingcomprises receiving a token that identifies the mobile station, whereinif the packet data serving node requires authorization prior toperforming the updating, the packet data serving node forwards the tokento a policy decision function which uses the token to determine ifauthorization is appropriate and provides an appropriate response to thepacket data serving node.
 13. A method, comprising: implementing a softfiltering rule at a packet data serving node; receiving acare-of-address associated with at least one of the mobile station and acorrespondent node; updating filters with the care-of-address tocorrectly identify flows belonging to a particular session during mobileinternet protocol use; and after the correspondent node starts using anew care-of-address, checking a predefined number of data packets toobserve a change of the care-of-address, prior to the updating.
 14. Amethod, comprising: implementing a soft filtering rule at a packet dataserving node; receiving a care-of-address associated with at least oneof the mobile station and a correspondent node; updating filters withthe care-of-address to correctly identify flows belonging to aparticular session during mobile internet protocol use; creating atemporary state upon detecting a binding update message from thecorrespondent node; and receiving a binding acknowledgement message fromthe mobile station to verify that the binding update message is valid,prior to the updating.
 15. An apparatus, comprising: an implementerconfigured to implement a soft filtering rule; a receiver configured toreceive a care-of-address that is associated with at least one of amobile station and a correspondent node; and an updater configured toupdate at least one of a plurality of filters configured in accordancewith the soft filtering rule, the at least one of the plurality offilters updated with the care-of-address to correctly identify flowsbelonging to a particular session during mobile internet protocol use,wherein the apparatus comprises a packet data serving node including theat least one or the plurality of filters being updated.
 16. Theapparatus of claim 15, wherein the implementer comprises an allowerconfigured to allow at least one mobility header message at apredetermined time, wherein the predetermined time is a configurableparameter.
 17. The apparatus of claim 15, wherein the receiver receivesa care-of-address update message in one of vendor specific extensions,resource reservation protocol messages or other message types.
 18. Theapparatus of claim 15, wherein the updater updates a service based localpolicy and a traffic flow template.
 19. The apparatus of claim 15,wherein the filter comprises a matcher configured to match a destinationinternet protocol address part of a filter with a packet in a uplinkdirection when at least one of a internet protocol address matches adestination field of an internet protocol packet or the internetprotocol address matches a home address of a routing extension headerand the care-of-address of the correspondent node matches thedestination field of the packet.
 20. The apparatus of claim 15, whereinthe apparatus comprises a network node.
 21. An apparatus, comprising: animplementer configured to implement a soft filtering rule; a receiverconfigured to receive a care-of-address that is associated with at leastone of a mobile station and a correspondent node; and an updaterconfigured to update at least one of a plurality of filters configuredin accordance with the soft filtering rule, the at least one of theplurality of filters updated with the care-of-address to correctlyidentify flows belonging to a particular session during mobile internetprotocol use, wherein the at least one of a plurality of filters isconfigured to filter packets including the care-of-address that isassociated with at least one of the mobile station and the correspondentnode, wherein the implementer further comprises an allower configured toallow at least one message at a predetermined time per mobility headermessage type for the care-of-address, if the mobile station and thecorrespondent node have an active route optimized session, wherein theapparatus comprises a packet data serving node including the at leastone or the plurality of filters being updated.
 22. The apparatus ofclaim 21, wherein the apparatus comprises a network node.
 23. Anapparatus, comprising: an implementer configured to implement a softfiltering rule; a receiver configured to receive a care-of-address thatis associated with at least one of a mobile station and a correspondentnode; an updater configured to update at least one of a plurality offilters configured in accordance with the soft filtering rule, the atleast one of the plurality of filters updated with the care-of-addressto correctly identify flows belonging to a particular session duringmobile internet protocol use, wherein the at least one of the pluralityof filters is configured to filter packets including the care-of-addressthat is associated with at least one of the mobile station and thecorrespondent node, wherein the implementer comprises an initiatorconfigured to initiate route optimization and mobile internet protocolsignaling messages by at least one mobile station outside of a codedivision multiple access network, wherein the apparatus comprises apacket data serving node including the at least one or the plurality offilters being updated.
 24. The apparatus of claim 23, wherein theapparatus comprises a network node.
 25. An apparatus, comprising: animplementer configured to implement a soft filtering rule; a receiverconfigured to receive a care-of-address that is associated with at leastone of a mobile station and a correspondent node; an updater configuredto update at least one of a plurality of filters configured inaccordance with the soft filtering rule, the at least one of theplurality of filters updated with the care-of-address to correctlyidentify flows belonging to a particular session during mobile internetprotocol use, wherein the at least one of the plurality of filters isconfigured to filter packets including the care-of-address that isassociated with the at least one of the mobile station and thecorrespondent node, wherein the receiver receives, from the mobilestation, a care-of-address update message when the mobile stationdetermines a set of possible addresses that might appear on an internetprotocol session that is associated with the mobile station, wherein theapparatus comprises a packet data serving node including the at leastone or the plurality of filters being updated.
 26. The apparatus ofclaim 25, wherein the apparatus comprises a network node.
 27. Anapparatus, comprising: an implementer configured to implement a softfiltering rule; a receiver configured to receive a care-of-address thatis associated with at least one of a mobile station and a correspondentnode; an updater configured to update filters with the care-of-addressto correctly identify flows belonging to a particular session duringmobile internet protocol use; and a filter configured to filter packetsincluding a care-of-address that is associated with one of the mobilestation and the correspondent node, wherein the receiver receives anewly acquired care-of-address sent by the correspondent node to themobile station.
 28. The apparatus of claim 27, wherein the apparatuscomprises a network node.
 29. An apparatus, comprising: an implementerconfigured to implement a soft filtering rule; a receiver configured toreceive a care-of-address that is associated with at least one of amobile station and a correspondent node; an updater configured to updatefilters with the care-of-address to correctly identify flows belongingto a particular session during mobile internet protocol use; and afilter configured to filter packets including a care-of-address that isassociated with one of the mobile station and the correspondent node,wherein the receiver receives a token that identifies the mobilestation, wherein if the packet data serving node requires authorizationprior to performing the updating, the packet data serving node forwardsthe token to a policy decision function which uses the token todetermine if authorization is appropriate and provides an appropriateresponse to the packet data serving node.
 30. The apparatus of claim 29,wherein the apparatus comprises a network node.
 31. An apparatus,comprising: an implementer configured to implement a soft filteringrule; a receiver configured to receive a care-of-address that isassociated with at least one of a mobile station and a correspondentnode; an updater configured to update filters with the care-of-addressto correctly identify flows belonging to a particular session duringmobile internet protocol use; and a filter configured to filter packetsincluding a care-of-address that is associated with one of the mobilestation and the correspondent node, further comprising a checkerconfigured to check, after the correspondent node starts using a newcare-of-address, a predefined number of data packets to observe a changeof the care-of-address, prior to the updating.
 32. The apparatus ofclaim 31, wherein the apparatus comprises a network node.
 33. Anapparatus, comprising: an implementer configured to implement a softfiltering rule; a receiver configured to receive a care-of-address thatis associated with at least one of a mobile station and a correspondentnode; an updater configured to update filters with the care-of-addressto correctly identify flows belonging to a particular session duringmobile internet protocol use; and a filter configured to filter packetsincluding a care-of-address that is associated with one of the mobilestation and the correspondent node, further comprising a creatorconfigured to create a temporary state upon detecting a binding updatemessage from the correspondent node; and a receiver configured toreceive a binding acknowledgement message from the mobile station toverify that the binding update message is valid, prior to the updating.34. The apparatus of claim 33, wherein the apparatus comprises a networknode.
 35. The apparatus of claim 15, wherein the filter comprises amatcher configured to match a source internet protocol address part of afilter with a packet in a downlink direction when at least one of thesource internet protocol address matches a source field of an internetprotocol packet or the source internet protocol address matches a homeaddress of a destination options extension header and thecare-of-address of the correspondent node matches the source field ofthe packet.
 36. A method, comprising: determining, by a mobile station,at least a care-of-address associated with at least one of the mobilestation and a correspondent node; and sending, by the mobile station toa packet data serving node, a filter update message comprising thecare-of-address associated with at least one of the mobile station andthe correspondent node to allow updating a soft filtering ruleimplemented at the packet data serving node with the care-of-addressassociated with at least one of the mobile station and the correspondentnode different from the packet data serving node.
 37. An apparatus,comprising: a mobile station comprising a determiner configured todetermine at least a care-of-address associated with at least one of themobile station and a correspondent node, and further configured to send,to a packet data serving node, a filter update message comprising thecare-of-address associated with at least one of the mobile station andthe correspondent node to allow updating a soft filtering ruleimplemented at the packet data serving node with the care-of-addressassociated with at least one of the mobile station and the correspondentnode different from the packet data serving node.